I'm glad to see this come back up (even though the title frames the issue entirely backwards: it's less about one guy breaking things and more about the malprac

I'm glad to see this come back up (even though the title frames the issue entirely backwards: it's less about one guy breaking things and more about the malpractice of building systems that are brittle from day one) because I don't think folks have really learned from the perils of unnecessary yet load-bearing dependencies. At the very least, I hope the conversation is still alive enough for groups to invest in mirror registries to have some form control over external dependency sources. At [previous gig], it's something that always felt like an expense that needs a lot of justification with the powers that be despite feeling like table stakes for keeping a revenue-generating app up in the long term.